Model comprehension for security risk assessment